Senators to FINRA: make transfer locks a rule

The account-transfer lock is the rare piece of fraud prevention that is also a competitive weapon, which may be why Elizabeth Warren of Massachusetts and Ron Wyden of Oregon want FINRA to write it into the rulebook. The two Democratic senators wrote to FINRA President and CEO Robert Cook on August 20 urging the self-regulator to require firms to let customers lock their accounts, PLANADVISER reports.

Their target is the Automated Customer Account Transfer Service, the rails that carry client assets between brokerages and, increasingly, the route of a specific fraud: a criminal uses stolen personal information to open an account in the victim's name at a second firm, then initiates an ACATS transfer out of the victim's legitimate account. "Bad actors are increasingly exploiting structural weaknesses in the ACATS system to illicitly drain consumers' brokerage accounts, including retirement funds," the senators wrote.

ACATS was built for the customer who wants to leave—an outgoing brokerage gets one business day to validate or object and three days to complete the move. That timetable keeps firms from slow-walking departing clients, but it also means no one has to confirm that the account holder actually ordered the outbound transfer. The senators want FINRA to require notifications of ACATS requests and to mandate phishing-resistant multi-factor authentication such as passkeys, moving beyond FINRA's current recommendation that brokers merely notify account holders. The request lands on a desk already busy after the SEC's August request that FINRA design an accredited-investor exam that tests know-how.

The senators' comparison of major brokers found just two—Fidelity Investments and Vanguard—that let clients set a transfer lock on their own, while others would block a transfer only if the client called customer service, were still building self-service locks, or offered no block at all. Webull Financial and Interactive Brokers agreed to develop self-service locks after the senators reached out directly, according to the senators' release. FINRA has until September 17 to respond.

A transfer lock is the right trade, putting friction in front of every legitimate transfer—including the account moves that make team liftouts and breakaways possible—because an unauthorized transfer is the costliest friction of all. Today's recommendation-only posture leaves the burden on the victim to notice a theft in progress, while Fidelity and Vanguard get to present transfer locks as a reason to hold assets with them and competitors have to explain why the feature is still on the way. Advisors should know which side of that divide their custodian sits on before a client asks.